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Minutes of Meeting — 5 March 2020 


NRS Audit and Risk Committee (ARC) Meeting 


5 March 2020 


Lord Clerk’s Register Room, General Register House, Edinburgh 


Attendees: 


Colin Ledlie (Chair) 


Christine Martin 
Asif Haseeb 
Jonny Steen 
Dougie Shepherd 
Lorraine Twyford 
Paul Lowe 

Linda Sinclair 
Laura Mitchell 
Carla McHendry 
Steven Hanlon 
Pete Whitehouse 
Andy Robertson 
Shirley Cameron 
Paula Gellatly 


Apologies: 
Bill Matthews 


NRS Non-Executive Director 

NRS Non-Executive Director 

External Auditor — Audit Scotland 

External Auditor — Audit Scotland 

Internal Auditor — Scottish Government 

Internal Auditor - Scottish Government 

NRS, Chief Executive 

NRS, Director of Corporate Services & Accountable officer 
NRS, Director of Information and Records Services (item 3) 
NRS, Delivery Director (observer) 

NRS, Chief Financial Officer 

NRS, Director of Statistical Services (item 9) 

Census Director Team (item 8 & 9) 

NRS, Business Management, secretariat 

Corporate Governance Manager, secretariat 


NRS Non-Executive Director 


1. Welcome, Introductions and Declaration of Interests 


1.1 The Chair welcomed everyone to the meeting, including Carla McHendry and 
Paula Gellatly, attending their first meeting. Other attendees were noted as Laura 
Mitchell, Andy Robertson and Pete Whitehouse for items as listed above. Apologies and 
observers were noted. 


1.2 There were no new Declarations of Interest. 
2. Minutes and Actions 


2.1 The minutes of 28 November 2019 were accepted with one minor amendment 
to the apologies section. The minutes would be published on the NRS website, 
governance page. 


2.2 Actions were reviewed as follows: 


e Action A07/19: Induction and training opportunities for ARC. The action was 
ongoing. Induction had continued individually with Christine Martin, however 
further opportunities for building tours and staff engagement for the wider 
NXD group would be explored, alongside opportunities for SG Digital 
Assurance awareness opportunities. Action: ongoing. 
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e Action A08/19: Census Programme - provide the Committee with a deep 
dive for two risk topics at each meeting. Forward schedule updated. 
Completed. 


Risk Deep Dive - NRS Estates Deep Dive follow-up report (including 
archive physical preservation) — Linda Sinclair and Laura Mitchell 


Linda Sinclair explained the paper was a follow-up to a previous deep dive and 


provided a more in-depth review of three risks reported for Estates. These were: 


3.2 


Storage capacity 
Accommodation for NRS Staff 
Physical security/health and safety 


Laura Mitchell provided an overview of the risk noted as Storage Capacity. This 


was noted and discussed as follows: 


3.3 


The background to the risk and the challenges being faced in terms of 
ongoing storage demands and projected capacity issues that would arise over 
the next 3-5 years 
Archival Storage — despite digital storage solutions, paper continued to be 
deposited in quantity and this was likely to continue for quite some time. 
Three key challenges were highlighted to the Committee: 

1. Buildings with archival storage; 

2. Storage environment; and 

3. Capacity for immediate future needs 
Future Storage options — it was noted that storage would become an issue in 
the future, short and longer term opportunities and options to optimise and 
utilise space in different ways would be considered. 
It is was also noted that depositor organisations are now creating both paper 
and digital records. The challenge was known and containable at present. 
It was noted that a programme would be initiated, to look at and explore 
options which would likely require capital funding. 
A follow-up to the deep dive would be reported and timetabled for further 
discussion. 


Linda Sinclair provided an overview of risk noted as Accommodation for NRS 


Staff, as follows: 


Key objectives for NRS Estates were reported as — facilities management, 
compliance, meeting business requirements, internal and external maintenance 
of buildings and surroundings, and tenant and lease management. 

NRS buildings -maintenance was a significant focus of Estates activity. 
Challenges were noted as — the condition of the Historic estate, maintenance 
backlog; lack of systems to support operations; and capacity issues in terms of 
in-house specialist expertise and resource requirements. There had been some 
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increases in team resources but not all of these additional posts had been filled 
to date. 

e Opportunities were noted as — full review of estate condition; information 
gathering on plant, building and operations; external resource expertise utilised; 
and advancement in technology. 

e An overview of the Estates activity for each of the six NRS buildings was 
reported. 


3.4 Linda Sinclair provided an overview of the risk noted as Physical 
Security/Health and Safety, which included: 


e Physical security — recruitment of resource to lead on security for estates had 
been successful , with a new Head of Physical Security expected to start in April. 

e Health & Safety — an external review had reported in January 2020. A number 
of recommendations had been identified and it was noted that these would be 
developed into an action plan with shorter and longer term deliverables. 
Additional resources were also being recruited to support this work. 


3.5 The Committee noted the progress made. A further deep dive update would be 
built into the forward meeting plan. 


4. NRS Finance Report — End Period 9 - Steven Hanlon 


4.1 Steven Hanlon presented the report which provided the financial position at the 
end of period 9 of the 2019-2020 financial year. 


4.2 The Committee heard that the reported overall figure for NRS originated from 
component parts from core NRS and the Census Programme. Overall a small projected 
underspend of £0.6m was reported with consideration of opportunities to accelerate 
planned work to mitigate any further increase in underspend. 


4.3 The draft budget for 2020/21 had now been agreed by the Scottish Parliament, 
with the NRS Executive Management Board to be asked to approve the allocation at 
their meeting in March 2020. 


4.4 A request for the finance report to be developed to include the period between 
meetings would be actioned. 


Action A01/20: To develop the Finance report to include the period between 
meetings. Owner: Steven Hanlon 


5. Draft Internal Audit Plan for the coming financial year and progress 
reports on active/follow-up audit - Lorraine Twyford 


5.1 Lorraine Twyford indicated that the 2019-2020 plan was nearly completed. Two 
audits had concluded with final reports issued, both of these had provided a substantial 
assurance opinion. A third audit, to review ICT Requisitioning had also concluded and 
was noted as ‘substantial’. 
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5.2 It was noted that Dougie Shepherd would be moving to a new role and would 
be replaced by Kate Moffat as the Senior Internal Audit Lead supporting NRS. Paul 
Lowe thanked Dougie Shepherd for his support and his collaborative approach to the 
Internal Audit reviews. 


6. External Annual Audit Plan for 2019-2020 - Asif Haseeb 


6.1 Jonny Steen summarised the planned audit activity which would focus on six 
key areas as stated in the report. 


6.2 The timelines of plan indicated that the Annual Audit Report would be presented 
at the ARC meeting on 3 September 2020. The Committee noted the plan. 


7. NRS Assurance Activity Update - Linda Sinclair 


7.1 The report provided an update on NRS assurance activities since the last report 
had been presented to ARC in November 2019. 


7.2 Linda Sinclair summarised the paper and also provided an update on the 
approach being developed to map assurance activities according to three levels of 
assurance (lines of defence). Internal and external assurance against seven risk 
themes identified on the corporate risk register would also be developed to provide a 
RAG status highlight report. The Committee were invited to note the approach. 


8. NRS 2021 Census - assurance report — Andy Robertson 


8.1 Andy Robertson presented the report which the Committee were invited to note. 
The report included an overview of the Census status summary as well as an overview 
of assurance activities as follows: 


Census Assurance Reviews already applied 

Assurance Recommendations Summary / Status — NRS Level 
Assurance Recommendations Summary / Status — Programme Level 
Assurance Action Plan Review Results — Feb 20 

Assurance Considerations / Key points 

Assurance Schedule for remainder of Census 

Digital First Internal Review — Key Issues 


8.2 Paul Lowe commented that the change in status reported in early 2019 from 
RED to AMBER/RED later that year signified the focus that NRS had placed on the 
Census Programme at an Executive level. Encouraging further progress was being 
made to move the programme towards Amber. 


9. Deep Dive - NRS Census 2021 Risk Management (three risk themes 
scrutinised) - Andy Robertson and Peter Whitehouse 
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9.1 R001 - Legislation. Peter Whitehouse indicated that there were significant 
dependencies from the Census legislation to the delivery of the Census 2021 
Programme Plan. It was reported that the draft Census Order had been agreed by the 
Scottish Parliament on 4 March 2020, which was earlier than originally expected. The 
Order was expected to go to the Privy Council on 11 March 2020 with the Regulations 
now on track for approval following Parliamentary Committee scrutiny, on 2 June 2020. 


9.2 The Committee noted that the approval of the Order by the Scottish Parliament 
reduced this risk. It was noted that risk of a legal challenge from a stakeholder group 
was possible however. 


9.3 Paul Lowe expressed his thanks for the efforts of the Census Legislation team 
in engaging formally with the Parliamentary Committee which had resulted in the early 
approval of the Census Order and the reduction of the risk. 


9.4 R007 - Fixed Timeline Pressure — Andy Robertson summarised the risk that 
fixed delivery timelines for Census 2021 and commitments to the production of first 
results within the year could have a detrimental impact on programme budget, 
resourcing or quality of outputs. Areas being explored to provide mitigation, included 
planning considerations, contingency and budget in relation to financial and contract 
controls. 


9.5 R010 — 2020/2021 budget approval. Andy Robertson confirmed that R010 had 
been closed as the budget had now been agreed by Scottish Government. It was noted 
that the programme had opened R011 to retain monitoring and mitigate ongoing risks 
on budgets. 


10. Items To Note and Questions 


10.1 NRS Governance Report - risk management and internal controls — Linda 
Sinclair. The report was noted. 


10.2 NRS Audit Recommendations Status report. The report was noted 


10.3 Coronavirus risk - Colin Ledlie asked if resilience as part of a Business 
Continuity and incident management deep dive could be considered. Linda Sinclair 
would pick this up as part of a Business Continuity deep dive in May. Linda confirmed 
that there where various plans in place for Business Continuity which were linked in 
with SG HR and Incident Management processes if services to the public were to close 
and to support staff. 


Action: A02/20: To include resilience in the Business Continuity Deep Dive in 
May. Owner: Linda Sinclair 


11. ARC Forward Look for year ahead & EMB Forward Look. - Linda Sinclair 
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11.1 With Business Continuity being considered as a deep dive at the meeting on 
28 May, a planned IT Delivery deep dive would be moved to 3 September ARC. An 
Estates deep dive follow-up would be timetabled. 


12. Date of Next Meeting - 28 May 2020 
END 


